5873 matches found
CVE-2022-29020: Improper Neutralization of Input During Web Page Generation
ForestBlog through 2022-02-16 allows admin/profile/save userAvatar XSS during addition of a user avatar...
Popup Maker < 1.16.5 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some of its Popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed Popup Maker Create Popup Popup Settings Triggers Add New Cookie Add Cookie...
CVE-2022-27291
D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formdumpeasysetup. This vulnerability allows attackers to cause a Denial of Service DoS via the config.savenetworkenabled parameter...
CVE-2022-27291
D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formdumpeasysetup. This vulnerability allows attackers to cause a Denial of Service DoS via the config.savenetworkenabled parameter...
D-Link DIR-619 buffer error vulnerability
D-Link DIR-619 is a series of routers from D-Link, a Chinese company. D-Link DIR-619 Ax v1.00 has a security vulnerability that can be exploited by attackers to cause a denial of service DoS via the config.savenetworkenabled parameter...
CVE-2022-1287
A vulnerability classified as critical was found in School Club Application System 1.0. This vulnerability affects a request to the file /scas/classes/Users.php?f=saveuser. The manipulation with a POST request leads to privilege escalation. The attack can be initiated remotely and does not requir...
PT-2022-13776
Name of the Vulnerable Software and Affected Versions School Club Application System version 1.0 Description A critical issue was found in the system, affecting requests to the "/scas/classes/Users.php?f=save user" endpoint. The manipulation with a POST request leads to privilege escalation. The...
libvips:webpsave_buffer_fuzzer: Heap-buffer-overflow in ConvertRGB24ToY_SSE41
Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=5456365075693568 Project: libvips Fuzzing Engine: honggfuzz Fuzz Target: webpsavebufferfuzzer Job Type: honggfuzzasanlibvips Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...
Google Chrome security vulnerabilities
Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome, which is caused by the window.showSaveFilePicker function that parses and returns environment variable values to the user when passing environment variables, which can be exploited by an attacker to...
libvips:webpsave_buffer_fuzzer: Heap-use-after-free in save_marker
Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=6427211915198464 Project: libvips Fuzzing Engine: afl Fuzz Target: webpsavebufferfuzzer Job Type: aflasanlibvips Platform Id: linux Crash Type: Heap-use-after-free WRITE 1 Crash Address:...
April 5, 2022, update for Project 2016 (KB5002132)
None None...
libvips:gifsave_buffer_fuzzer: Heap-use-after-free in jpeg_fill_bit_buffer
Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=5252884758921216 Project: libvips Fuzzing Engine: libFuzzer Fuzz Target: gifsavebufferfuzzer Job Type: libfuzzerasanlibvips Platform Id: linux Crash Type: Heap-use-after-free WRITE 4 Crash Address:...
WordPress plugin MapPress Maps code vulnerability
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress MapPress Maps plugin has an authorization problem vulnerability that stems from a lack of authentication measures or...
CVE-2021-32957
A function in MDT AutoSave versions prior to v6.02.06 is used to retrieve system information for a specific process, and this information collection executes multiple commands and summarizes the information into an XML. This function and subsequent process gives full path to the executable and is...
CVE-2022-1075
A vulnerability was found in College Website Management System 1.0 and classified as problematic. Affected by this issue is the file /cwms/classes/Master.php?f=savecontact of the component Contact Handler. The manipulation leads to persistent cross site scripting. The attack may be launched...
PT-2022-13637
Name of the Vulnerable Software and Affected Versions College Website Management System version 1.0 Description A vulnerability was found in the College Website Management System, affecting the file "/cwms/classes/Master.php?f=save contact" of the component Contact Handler. This issue leads to...
Sourcecodester Simple College Website Cross-site Scripting Vulnerability
Sourcecodester Simple College Website is Sourcecodester an open source application . A content management system. A security vulnerability exists in College Website Management System 1.0, which can be exploited by a remote attacker via the file /cwms/classes/Master.php?f=savecontact of the...
Passwords stored in plain text by instant-messaging
instant-messaging provides a framework for plugins integrating Jenkins with instant messaging services. instant-messaging 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on instant-messaging on the Jenkins controller. These passwords...